CHAPTER 21 This chapter describes how to configure the IEEE 802.1ak Multiple VLAN Registration Protocol () and Multiple Registration Protocol (MRP) as implemented in accordance with the IEEE 802.1ak standard. Understanding IEEE 802.1ak and MRP, page 21-1 IEEE 802.1ak and MRP Guidelines and Restrictions, page 21-7, page 21-8 Troubleshooting the Configuration, page 21-10 Configuration Examples for IEEE 802.1ak and MRP, page 21-11 Note This feature appears in Cisco Feature navigator as IEEE 802.1ak - and MRP. Understanding IEEE 802.1ak and MRP These sctions describe IEEE 802.1ak and MRP: Overview, page 21-1 Dynamic VLAN Creation, page 21-3 Interoperability with VTP, page 21-3 Interoperation with Non-Cisco Devices, page 21-5 Interoperability with Other Software Features and Protocols, page 21-5 Overview supports dynamic registration and deregistration of VLANs on ports in a VLAN bridged network. IEEE 802.1ak uses more efficient Protocol Data Units (PDUs) and protocol design to provide better performance than the Generic VLAN Registration Protocol (GARP) VLAN Registration Protocol (GVRP) and GARP Multicast Registration Protocol (GMRP) protocols. A VLAN-bridged network usually restricts unknown unicast, multicast, and broadcast traffic to those links that the traffic uses to access the appropriate network devices. In a large network, localized topology changes can affect the service over a much larger portion of the network. IEEE 802.1ak replaces GARP with MRP, which provides improved resource utilization and bandwidth conservation. 21-1
Understanding IEEE 802.1ak and MRP Chapter 21 With the 802.1ak MRP attribute encoding scheme, only needs to send one PDU that includes the state of all 4094 VLANs on a port. also transmits Topology Change Notifications (TCNs) for individual VLANs. This is an important feature for service providers because it allows them to localize topology changes. Figure 21-1 illustrates deployed in a provider network on provider and customer bridges. Figure 21-1 Deployed on Provider and Customer Bridges H1 CB-3 PB-2 H2 CB-1 PB-1 PB-4 CB-1 H5 PB-3 CB-2 CB-2 H3 H4 H6 H7 runs on Customer Bridges runs on Provider Bridges 274481 Because most providers do not wish to filter traffic by destination MAC addresses, a pruning protocol like is important in a Metro Ethernet provider network, which often uses thousands of VLANs. 21-2
Chapter 21 Understanding IEEE 802.1ak and MRP Figure 21-2 dispalys redundant links that are configured between the access switch and two distribution switches on the cloud. When the link with VLAN 104 fails over, needs to send only one TCN for VLAN 104. Without, an STP TCN would need to be sent out for the whole MST region (VLANs1-1000), which could cause unnecessary network interruption. STP sets the tcdetected variable to signal that must decide whether to send an TCN. can flush filtering database entries rapidly on a per-vlan basis following a topology change because when a port receives an attribute declaration marked as new, any entries in the filtering database for that port and for that VLAN are removed. Figure 21-2 TCN Application MST1 V1-1000 MST2 V2001-3000 V1050 V104 V104 Applicant Redundant links TCN for v104 274480 Dynamic VLAN Creation Virtual Trunking Protocol (VTP) is a Cisco proprietary protocol that distributes VLAN configuration information across multiple devices within a VTP domain. When VTP is running on -aware devices, all of the VLANs allowed on the Cisco bridged LAN segments are determined by VTP. Only the VTP transparent mode supports dynamic VLAN creation. When dynamic VLAN creation is disabled, the trunk ports can register and propagate the VLAN messages only for existing VLANs. PDUs and messages for the nonexistant VLANs are discarded. For a switch to be configured in full compliance with the standard, the switch VTP mode must be transparent and dynamic VLAN creation must be enabled. Interoperability with VTP These sections describe and VTP: Overview, page 21-4 VTP in Transparent or Off Mode, page 21-4 21-3
Understanding IEEE 802.1ak and MRP Chapter 21 VTP in Server or Client Mode and VTP Pruning is Disabled, page 21-4 VTP in Server or Client Mode and VTP Pruning is Enabled, page 21-4 Overview VTP in Transparent or Off Mode The VLAN Trunking Protocol (VTP) is a Cisco proprietary protocol that distributes VLAN configuration information across multiple devices within a VTP domain. VTP pruning is an extension of VTP. It has its own Join message that can be exchanged with VTP PDUs. VTP PDUs can be transmitted on both 802.1Q trunks and ISL trunks. A VTP-capable device is in one of the VTP modes: server, client, transparent, or off. When VTP Pruning and are both enabled globally, runs on trunks where it is enabled and VTP Pruning runs on other trunks. or VTP pruning can be enabled on a trunk, but not both. When VTP is in transparent or off mode, VTP pruning is not supported and VTP PDUs are not processed. When a port receives an join message for a VLAN, the port transmits broadcast, multicast, and unknown unicast frames in that VLAN and adds the traffic definition to the MRP Attribute Propagation (MAP) port configured for that VLAN. The mapping is removed when the VLAN is no longer registered on the port. For each interface that is forwarding in each VLAN, issues a join request to each MRP Attribute Declaration (MAD) instance and an Join message is sent out on each corresponding port. dynamic VLAN creation can be enabled in VTP transparent or off mode. If it is enabled and the VLAN registered by a join message does not exist in the VLAN database in the device, then the VLAN will be created. VTP in Server or Client Mode and VTP Pruning is Disabled functions like VTP in transparent or off mode, except that dynamic VLAN creation is not allowed. VTP in Server or Client Mode and VTP Pruning is Enabled and VTP with pruning disabled can be supported on the same port and these two protocols need to communicate and exchange pruning information. When VTP receives a VTP join message on a VTP trunk, is notified so that join request can be posted to the port MAD instances, and join messages are out on the ports to the network. When VTP pruning removes a VLAN from a VTP trunk, sends a leave request to all the MAD instances and the MAD instances send a leave or empty message from the ports to indicate that the VLAN is not configured on the device. When an port received an join message, propagates the event to other ports in the same MAP context, and notifies VTP so that VTP pruning can send a VTP join message from the VTP trunk ports. If learns that a VLAN is no longer declared by the neighboring devices, sends a withdrawal event to VTP and then VTP pruning verifies that it should continue sending VTP join messages. 21-4
Chapter 21 Understanding IEEE 802.1ak and MRP For VLANs that are configured as VTP pruning non-eligible on the VTP trunks, the VTP pruning state variables are set to joined for the VLANs. join requests are sent to those VLANs through the ports. Interoperation with Non-Cisco Devices Non-Cisco devices can interoperate with a Cisco device only through 802.1q trunks. Interoperability with Other Software Features and Protocols 802.1x and Port Security These sections describes interoperability with these protocols: 802.1x and Port Security, page 21-5 DTP, page 21-5 EtherChannel, page 21-6 Flex Links, page 21-6 High Availability, page 21-6 ISSU and efsu, page 21-6 L2PT, page 21-6 SPAN, page 21-6 Unknown Unicast and Multicast Flood Control, page 21-6 STP, page 21-6 UDLR, page 21-6 VLANs with, page 21-7 802.1x authenticates and authorizes a port after it transitions to the link-up state, but before DTP negotiation occurs and runs on a port. Port security works independently of. Note When is globally enabled, the MAC address auto detect and provision feature is disabled by default (mvrp mac-learning auto). In some situations, MAC address auto detect and provision can disable MAC address learning and prevent correct port security operation. For example, on ports where port security is configured, when the number of streams exceeds the configured maximum number of MAC addresses, no port security violation occurs because MAC address learning is disabled, which prevents updates to port security about the streams coming into the port. To avoid incorrect port security operation, use caution when enabling the MAC address auto detect and provision feature on ports where port security is configured. DTP DTP negotiation occurs after ports transition to the link-up state and before transition to the forwarding state. If is administratively enabled globally and enabled on a port, it becomes operational when the port starts trunking. 21-5
Understanding IEEE 802.1ak and MRP Chapter 21 EtherChannel An EtherChannel port-channel interface can be configured as an participant. The EtherChannel member ports cannot be participants. learns the STP state of EtherChannel port-channel interfaces. The MAP context applies to the EtherChannel port-channel interfaces, but not to the EtherChannel member ports. Flex Links declares VLANs on STP forwarding ports but not on ports in the blocking state. On flex links ports, declares VLANs on the active ports but not on the standby ports. when a standby port takes over and an active port transitions to the link-down state, declares the VLANs on the newly active port. High Availability State Switchover (SSO) and ISSU supports. ISSU and efsu Enhanced Fast Software Upgrade (EFSU) is an enhanced software upgrade procedure. is serviced by the ISSU client identified as ISSU CLIENT_ID. L2PT Layer 2 Protocol Tunneling (L2PT) does not support PDUs on 802.1Q tunnel ports. SPAN ports can be configured as either Switched Port Analyzer (SPAN) sources or destinations. Unknown Unicast and Multicast Flood Control and the Unknown Unicast and Multicast Flood Control feature, configured with the switchport block command, cannot be configured on the same port. STP An STP mode change causes forwarding ports to leave the forwarding state until STP reconverges in the newly configured mode. The reconvergence might cause an topology change because join messages might be received on different forwarding ports, and leave timers might expire on other ports. UDLR and unidirectional link routing (UDLR) cannot be configured on the same port. 21-6
Chapter 21 IEEE 802.1ak and MRP Guidelines and Restrictions VLANs with VLAN Translation 802.1Q Native VLAN Tagging Private VLANs This sections decribe interactions between VLANs and : VLAN Translation, page 21-7 802.1Q Native VLAN Tagging, page 21-7 Private VLANs, page 21-7 VLAN translation and cannot be configured on the same port. Other participants might not be able to accept tagged PDUs in the 802.1Q native VLAN. Compatibility between and 802.1Q native VLAN tagging depends on the specific network configuration. Private VLAN ports cannot support. IEEE 802.1ak and MRP Guidelines and Restrictions When configuring IEEE 802.1ak and MRP, follow these guidelines and restrictions: In releases where CSCta96338 is not resolved, a physical port with an configuration and enable state that differs from what is configured on a port-channel interface cannot become an active member of that EtherChannel. In releases where CSCta96338 is resolved, a physical port with an configuration and enable state that differs from what is configured on a port-channel interface can become an active member of the EtherChannel because the physical port will use the port-channel interface configuration and enable state. A non-cisco device can interoperate with a Cisco device only through 802.1Q trunks. runs on ports where it is enabled. VTP pruning can run on ports where is not enabled. can be configured on both physical interfaces and EtherChannel interfaces, but is not supported on EtherChannel member ports. dynamic VLAN creation is not supported when the device is running in VTP server or client mode. and Connectivity Fault Management (CFM) can coexist but if the module does not have enough MAC address match registers to support both protocols, the ports on those modules are put in the error-disabled state. To use the ports that have been shut down, disable on the ports, and then enter shutdown and no shutdown commands. 802.1X authentication and authorization takes place after the port becomes active and before the Dynamic Trunking Protocol (DTP) negotiations start prior to running on the port. Do not enable automatic MAC address learning on edge switches that are configured with access ports. Enable automatic MAC address learning only on core switches where all the trunk interfaces are running. 21-7
Chapter 21 is supported only on Layer 2 trunks. is not supported on subinterfaces. These sections describe how to configure IEEE 802.1ak and MRP: Enabling, page 21-8 Enabling Automatic Detection of MAC Addresses, page 21-9 Enabling Dynamic VLAN Creation, page 21-9 Changing the Registrar State, page 21-9 Enabling must be enabled globally and on trunk ports. To enable, perform this task: Command or Action Purpose Step 1 Enables privileged EXEC mode (enter your password if prompted). Step 2 Enters global configuration mode. Step 3 Router(config)# mvrp global Globally enables. Step 4 Router(config)# interface type number Specifies and interface and enters interface configuration mode. Step 5 Router(config-if)# mvrp Enables on the interface. Note If is not successfully enabled on the port, the port is put in the errdisabled state. Enter the shutdown and no shutdown commands to clear the errdisabled state. This example shows how to enable globally and on an interface: Router(config)# mvrp global Router(config)# interface FastEthernet 2/1 Router(config-if)# mvrp 21-8
Chapter 21 Enabling Automatic Detection of MAC Addresses automatic detection of MAC addresses is disabled by default. To enable automatic detection of MAC addresses on VLANs, perform this task: Command or Action Purpose Step 1 Enables privileged EXEC mode (enter your password if prompted). Step 2 Enters global configuration mode. Step 3 Router(config)# mvrp mac-learning auto Enables MAC address learning. This example shows how to enable automatic MAC address learning: Router(config)# mvrp mac-learning auto Enabling Dynamic VLAN Creation To enable dynamic VLAN creation, perform this task: Command or Action Purpose Step 1 Enables privileged EXEC mode (enter your password if prompted). Step 2 Enters global configuration mode. Step 3 Router(config)# vtp mode transparent Sets VTP mode to transparent. Note Required for dynamic VLAN creation. Step 4 Router(config)# mvrp vlan creation Enables MRVP dynamic VLAN creation. This example shows how to enable dynamic VLAN creation: Router(config)# vtp mode transparent Router(config)# mvrp vlan create Changing the Registrar State The MRP protocol allows one participant per application in an end station, and one per application per port in a bridge. To set the registrar state, perform this task: Command or Action Purpose Step 1 Enables privileged EXEC mode (enter your password if prompted). Step 2 Enters global configuration mode. 21-9
Troubleshooting the Configuration Chapter 21 Command or Action Purpose Step 3 Router(config)# interface type number Specifies and interface and enters interface configuration mode. Step 4 Router(config-if)# mvrp registration [normal fixed forbidden] Registers with the MAD instance. This example shows how to set the registrar state to normal: Router(config)# interface FastEthernet 2/1 Router(config-if)# mvrp registration normal Troubleshooting the Configuration Use the show mvrp summary and show mvrp interface commands to display configuration information and interface states, and the debug mvrp command to enable all or a limited set of output messages related to an interface. To troubleshoot the configuration, perform this task: Command or Action Purpose Step 1 Enables privileged EXEC mode (enter your password if prompted). Step 2 Router# show mvrp summary Displays the configuration. Step 3 Router# show mvrp interface interface-type port/slot Displays the interface states for the specified interface. Step 4 Router# debug mvrp Displays debugging information. Step 5 Router# clear mvrp statistics Clears statistics on all interfaces. The following is sample output from the show mvrp summary command. This command can be used to display the configuration at the device level. Router# show mvrp summary global state : enabled VLAN creation : disabled VLANs created via : 20-45, 3001-3050 Learning disabled on VLANs : none The following is sample output from the show mvrp interface command. This command can be used to display interface details of the administrative and operational states of all or one particular trunk port in the device. Router# show mvrp interface Port Status Registrar State Fa3/1 off normal Port Join Timeout Leave Timeout Leaveall Timeout Fa3/1 201 600 700 1000 Port Vlans Declared 21-10
Chapter 21 Configuration Examples for IEEE 802.1ak and MRP Fa3/1 Port Fa3/1 Port Fa3/1 none Vlans Registered none Vlans Registered and in Spanning Tree Forwarding State none Configuration Examples for IEEE 802.1ak and MRP This section provides the following configuration examples: Enabling, page 21-11 Enabling Automatic Detection of MAC Addresses, page 21-11 Enabling Dynamic VLAN Creation, page 21-11 Changing the Registrar State, page 21-11 Enabling The following example shows how to enable : Router(config)# mvrp global Router(config)# interface fastethernet2/1 Router(config-if)# mvrp Enabling Automatic Detection of MAC Addresses The following example shows how to enable MAC address learning: Router(config)# mvrp mac-learning auto Enabling Dynamic VLAN Creation The following example shows how to enable dynamic VLAN creation: Router(config)# vtp mode transparent Router(config)# mvrp vlan create Changing the Registrar State The following example shows how to change the registrar state: Router(config)# mvrp registration normal 21-11
Configuration Examples for IEEE 802.1ak and MRP Chapter 21 21-12